Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files

Flags PowerShell Copy-Item operations targeting browser Login Data credential database paths on Windows.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-30
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555.003Credentials from Web Browsers
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell script content that copies files associated with browser credential stores, including Opera, Firefox profiles, and Chromium-based Edge/Chrome Login Data files. This behavior matters because attackers can steal stored website usernames and passwords that browsers keep in credential stores. The detection relies on ScriptBlockText telemetry and matches copy commands that reference specific browser Login Data paths.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange

Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)

Malicious Browser Credential Dump File Drop by Phantom Stealer via file_event

Suspicious Chromium Browser Launch with Remote Debugging Port for Cookie Theft (via process_creation)

Malicious dllFake Stealer Execution from WindowsApps Directory (via process_creation)

Malicious macOS Stealer Staging to Users Shared Directory (via process_creation)

Possible Spectre Ops C2 Beacon via nico and yfat Query Parameters via proxy

Suspicious Browser Kiosk Mode Forcing Credential Entry via process_creation

Malicious Live Ledger Stealer Execution via Ledger Lives Masquerade via process_creation

Suspicious Access to Chrome Encrypted Preference MAC Registry Values (via registry_set)

Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files

Pivot detection · T1555.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-access-to-browser-credential-database-files-fc028194

title: Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files
id: e6c922a5-2d4b-487d-9ec2-e03714a833e5
related:
  - id: 98f4c75c-3089-44f3-b733-b327b9cd9c9d
    type: obsolete
  - id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b
    type: similar
  - id: fc028194-969d-4122-8abe-0470d5b8f12f
    type: derived
status: test
description: This rule identifies PowerShell script content that copies files associated with browser credential stores, including Opera, Firefox profiles, and Chromium-based Edge/Chrome Login Data files. This behavior matters because attackers can steal stored website usernames and passwords that browsers keep in credential stores. The detection relies on ScriptBlockText telemetry and matches copy commands that reference specific browser Login Data paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml
author: frack113, Huntrule Team
date: 2022-01-30
tags:
  - attack.credential-access
  - attack.t1555.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmd:
    ScriptBlockText|contains|all:
      - Copy-Item
      - -Destination
  selection_path:
    ScriptBlockText|contains:
      - \Opera Software\Opera Stable\Login Data
      - \Mozilla\Firefox\Profiles
      - \Microsoft\Edge\User Data\Default
      - \Google\Chrome\User Data\Default\Login Data
      - \Google\Chrome\User Data\Default\Login Data For Account
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL